BugTraq
CS-Forum <= 0.81 Cross Site Scripting, SQL Injection, Full Path Disclosure Jun 11 2006 05:30PM
gmdarkfig gmail com
Cross Site Scripting

********************

http://[...]/read.php?msg_result=[XSS]

http://[...]/read.php?rep_titre=">[XSS]

Cookies: CSForum_nom=">[XSS]; CSForum_mail=">[XSS]; CSForum_url=">[XSS]

SQL Injection

*************

http://[...]/read.php?id=1'[SQL_SELECT]&debut=[SQL_LIMIT]

http://[...]/index.php?search=%'[SQL_SELECT]%23

http://[...]/index.php?debut=1[SQL] //Digit -> Without quote

Full Path Disclosure

********************

http://[...]/index.php?readall=&collapse[]= //setcookie()

Solution

********

SQL Injection => addslashes() / intval()

Cross Site Scripting => htmlentities()

Full Path Disclosure => is_string()

Credits

*******

by DarkFig -- http://www.acid-root.new.fr/advisories/csforum081.txt

Changelog

*********

[06-06-11] -- Vendor contacted

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus